FDA Approves Cybersecurity Fix for Cardiac Devices

By Sydny Shepard

Oct 15, 2018

In a voluntary recall, Medtronic has issued a software update to plug cybersecurity holes in programmers — which are kinds of software that physicians use to measure a connected device's performance, batter life and settings — for the company's implantable cardiac devices, according to the U.S. Food and Drug Administration.

The software update is meant to “address a safety risk caused by cybersecurity vulnerabilities associated with the internet connection” between the programmers, the FDA said in its safety communication. Regulators approved the update on Oct. 5 and said there are “no known reports of patient harm” stemming from the issue.

The cybersecurity vulnerabilities affected the Carelink 2090 and Carelink Encore 29901 programmers. Medtronic staffers use the technologies to update software in implanted cardiac devices. FDA officials said the programmers use a secure virtual private network but don’t verify that connection before downloading software updates.

Medtronic is developing additional security features to further fix the vulnerabilities, according to the FDA. Regulators noted that physicians can still use the programmers to test the cardiac implants, as these features do not require network activity. Other connected features that aren’t affected by the cybersecurity vulnerabilities will continue to function.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.